CVE-2022-29912

What it actually does

Reader mode requests fail to omit cookies that carry the SameSite attribute, allowing those cookies to be transmitted in cross-site contexts where SameSite protections should have blocked them.

Why it matters to the business

Users of affected browsers face elevated risk of cross-site request forgery or session credential leakage, which can result in unauthorized account access or actions performed on behalf of the user without their knowledge.

How an attack unfolds

An attacker supplies a crafted link that forces reader mode; when the victim activates the link the browser includes SameSite-protected cookies in the request, enabling the attacker to abuse those cookies for forgery or data exfiltration.

How to fix it

Upgrade Mozilla Firefox to 100 or later, Firefox ESR to 91.9 or later, and Thunderbird to 91.9 or later; re-apply organization-wide browser and mail-client update policies immediately.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases; test reader-mode navigation to cross-site resources and verify that SameSite cookies are no longer transmitted.

Typical attack path

1. Attacker crafts a URL designed to open in reader mode on a target site
2. Victim is tricked into following the link
3. Browser initiates the reader-mode request while incorrectly attaching SameSite cookies
4. Attacker receives or relays the request containing the cookies and abuses them for CSRF or session hijacking

How to detect it

Inspect network logs or browser telemetry for reader-mode requests that carry SameSite cookies to domains other than the cookie's origin; correlate with user-reported unexpected logins or actions.

What your security team should do

• Deploy browser and Thunderbird updates to all managed endpoints without delay
• Audit enterprise browser deployment pipelines to enforce minimum supported versions
• Add browser version checks to existing vulnerability scanning and asset inventory processes